UAC-0226 Startup LNK Executing Hidden PowerShell to Load C:\ProgramData\WC3

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•3

Detects a suspicious persistence mechanism where a LNK file in the user startup folder launches cmd.exe, which subsequently executes a hidden PowerShell process. The PowerShell process uses 'Get-Content' to read and 'Invoke-Expression' (IEX) to execute a file located at C:\ProgramData\WC3. This activity is associated with the UAC-0226 / GIFTEDCROOK delivery chain.